@redue/cli 0.1.0-alpha.11 → 0.1.0-alpha.12

package/src/claude-hook.mjs

@@ -6,68 +6,84 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import {spawn} from 'node:child_process';
+import {projectState} from './project-location.mjs';
+import {realObservedPath} from './path-identity.mjs';
 
 export const hookCommand='redue agent hook claude';
 const safe=/^[A-Za-z0-9_./:=,+-]+$/;
 const typecheck=check=>check?.kind==='typecheck'||check?.name==='typecheck';
 
+export const defaultConfig='redue.config.json';
+// The `redue` prefix for a config beside the project root; null when the name
+// would need shell quoting.
+export const redueFor=(configFile=defaultConfig)=>configFile===defaultConfig?'redue':
+  safe.test(configFile)?`redue --config ${configFile}`:null;
 // Exact commands that rerun each configured typecheck. Names that would need
 // shell quoting get no form, so the hook never fires for them.
-export function hookForms(config){
-  const rows=[];
+export function hookForms(config,configFile=defaultConfig){
+  const rows=[],redue=redueFor(configFile);
   for(const check of config?.checks||[]){
     if(!typecheck(check)||typeof check.name!=='string'||!safe.test(check.name))continue;
-    const forms=[`redue run ${check.name}`];
+    const forms=redue?[`${redue} run ${check.name}`]:[];
     // Other forms run from the project root, so they match only a root check.
-    if(check.cwd!==undefined&&check.cwd!=='.'){rows.push({check:check.name,forms});continue;}
+    if(check.cwd!==undefined&&check.cwd!=='.'){if(forms.length)rows.push({check:check.name,forms});continue;}
     if(config.packageManager==='npm'&&typeof check.script==='string'&&safe.test(check.script))
       forms.push(`npm run ${check.script}`);
     if(check.qualification==='npm-typescript-direct-v1')forms.push('npx tsc --noEmit');
     if(Array.isArray(check.command)&&check.command.length&&
       check.command.every(v=>typeof v==='string'&&safe.test(v)&&!v.startsWith('@')))
       forms.push(check.command.join(' '));
-    rows.push({check:check.name,forms:[...new Set(forms)]});
+    if(forms.length)rows.push({check:check.name,forms:[...new Set(forms)]});
   }
   return rows;
 }
 
 // Accept only an optional trailing `2>&1`, then an optional `| tail|head -n N`
-// or `-N`. Newlines separate commands, so they never match.
+// or `-N`, then optionally `;` or `&&` and the rest of the command. A form has
+// no shell metacharacters, so the first separator after it ends it. Newlines
+// separate commands, so they never match. The rest keeps its own spacing.
 function split(command){
   if(typeof command!=='string'||/[\r\n]/.test(command))return null;
-  const [,base,suffix]=command.trim().replace(/[ \t]+/g,' ')
-    .match(/^(.*?)((?: 2>&1)?(?: \| (?:tail|head) (?:-n \d+|-\d+))?)$/);
-  return {base,suffix};
+  const [,base,suffix,rest=null]=command.trim()
+    .match(/^(.*?)((?:[ \t]+2>&1)?(?:[ \t]+\|[ \t]+(?:tail|head)[ \t]+(?:-n[ \t]+\d+|-\d+))?)(?:[ \t]*(?:;|&&)[ \t]*([^\s;&|].*))?$/);
+  const one=text=>text.replace(/[ \t]+/g,' ');
+  return {base:one(base),suffix:one(suffix),rest};
 }
-export function matchCheck(command,config){
-  const parts=split(command);
-  return parts&&hookForms(config).find(row=>row.forms.includes(parts.base))?.check||null;
+function matched(command,config,configFile){
+  const parts=split(command),check=parts&&hookForms(config,configFile).find(row=>row.forms.includes(parts.base))?.check;
+  return check?{check,rest:parts.rest}:null;
 }
-// The same check through REDUE, keeping the output suffix; null if it already is.
-export function recordedCommand(command,name,configFile='redue.config.json'){
-  const parts=split(command);
-  if(!parts||!safe.test(name)||!safe.test(configFile))return null;
-  const run=`redue ${configFile==='redue.config.json'?'':`--config ${configFile} `}run ${name}`;
-  return parts.base===run||parts.base===`redue run ${name}`?null:run+parts.suffix;
+export function matchCheck(command,config,configFile){return matched(command,config,configFile)?.check||null;}
+// The same check through REDUE, keeping the output suffix; null if it already
+// is, or if more commands follow it.
+export function recordedCommand(command,name,configFile=defaultConfig){
+  const parts=split(command),redue=redueFor(configFile);
+  if(!parts||parts.rest!==null||!safe.test(name)||!redue)return null;
+  const run=`${redue} run ${name}`;
+  return parts.base===run?null:run+parts.suffix;
 }
 
-export function verdict(status,name){
+export function verdict(status,name,rest=null){
   const row=status?.schema===1&&status.observation?.healthy===true&&Array.isArray(status.checks)?
     status.checks.find(item=>item?.name===name):null;
   const runId=row?.invocation?.runId;
   if(!row||row.freshness!=='CURRENT'||row.result!=='PASS'||row.reuse_eligible!==true||
     typeof runId!=='string'||!/^[0-9a-f-]{36}$/.test(runId))return null;
   return `REDUE: check ${JSON.stringify(name)} passed on these exact inputs (run ${runId}); `+
-    'rerun skipped. To run it anyway, prefix the command with REDUE_FORCE=1.';
+    'rerun skipped. This counts as a pass for the current files; no status check is needed. '+
+    'To run it anyway, prefix the command with REDUE_FORCE=1.'+
+    (rest===null?'':` Nothing else in the command ran either; run the rest on its own: ${rest}`);
 }
 
 function synchronizedStatus(entry,config,root,timeout){
   return new Promise(resolve=>{
     let child,out='',done=false;
-    const finish=value=>{if(done)return;done=true;clearTimeout(timer);
+    const finish=value=>{if(done)return;done=true;clearTimeout(timer);process.off('SIGTERM',stop);
       if(child?.pid&&child.exitCode===null)try{process.platform==='win32'?child.kill('SIGKILL'):process.kill(-child.pid,'SIGKILL');}catch{}
       resolve(value);};
     const timer=setTimeout(()=>finish(null),timeout);
+    // Claude Code ends a hook that outlives its own timeout; end the status call with it.
+    const stop=()=>finish(null);process.once('SIGTERM',stop);
     // Its own process group on POSIX, so a timeout also ends the engine it starts.
     try{child=spawn(process.execPath,[entry,'--config',config,'status','--sync','--json'],
       {cwd:root,stdio:['ignore','pipe','ignore'],env:process.env,windowsHide:true,detached:process.platform!=='win32'});}
@@ -79,8 +95,22 @@ function synchronizedStatus(entry,config,root,timeout){
   });
 }
 
+// Waiting for status never costs more than half the check: half the last
+// completed run's duration, at most 10 s. With no completed run, 2 s.
+export function statusTimeout(status,name){
+  const run=Array.isArray(status?.checks)?status.checks.find(row=>row?.name===name)?.invocation:null;
+  return run?.status==='exited'&&Number.isFinite(run.durationMs)&&run.durationMs>=0?
+    Math.min(run.durationMs/2,10000):2000;
+}
+// From the observer's last published status, which is small, not the receipts.
+export function lastRunTimeout(config,parsed,name){
+  try{const root=realObservedPath(path.resolve(path.dirname(config),parsed.root||'.'));
+    return statusTimeout(JSON.parse(fs.readFileSync(path.join(projectState(root,config),'status.json'),'utf8')),name);}
+  catch{return 2000;}
+}
+
 // Returns the hook's stdout object, or null to allow the command.
-export async function claudeHook(input,{entry,timeout=2000}){
+export async function claudeHook(input,{entry,timeout}){
   if(input?.tool_name!=='Bash')return null;
   const command=input.tool_input?.command,root=input.cwd;
   if(typeof command!=='string'||/^\s*REDUE_FORCE=1(?:\s|$)/.test(command))return null;
@@ -89,13 +119,16 @@ export async function claudeHook(input,{entry,timeout=2000}){
   if(record?.schema!==1||record.host!=='claude'||typeof record.config!=='string'||
     !/^[^/\\]+\.json$/.test(record.config))return null;
   const config=path.join(root,record.config);
-  const name=matchCheck(command,JSON.parse(fs.readFileSync(config,'utf8')));
-  if(!name)return null;
-  const status=await synchronizedStatus(entry,config,root,timeout),reason=verdict(status,name);
+  const parsed=JSON.parse(fs.readFileSync(config,'utf8')),match=matched(command,parsed,record.config);
+  if(!match)return null;
+  const name=match.check,status=await synchronizedStatus(entry,config,root,timeout??lastRunTimeout(config,parsed,name)),
+    reason=verdict(status,name,match.rest);
   if(reason)return {hookSpecificOutput:{hookEventName:'PreToolUse',
     permissionDecision:'deny',permissionDecisionReason:reason}};
   // Rewrite only on a healthy answer for this check: without an observer,
-  // `redue run` cannot record, so the command stays as Claude sent it.
+  // `redue run` cannot record, so the command stays as Claude sent it. A chain
+  // stays too: the rewrite returns "allow", which would also skip the prompt
+  // for the rest of the chain.
   const rewritten=status?.schema===1&&status.observation?.healthy===true&&Array.isArray(status.checks)&&
     status.checks.some(item=>item?.name===name)?recordedCommand(command,name,record.config):null;
   // updatedInput replaces the whole tool input. Deny and ask rules still apply

package/src/cli.mjs

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import fs from 'node:fs';
 import {directQualification,directInterpretation,observedNpmContext} from './direct-typescript.mjs';
-import {directRunCertificateAllowed,directRunCertificate,directRunRecording,validateRunRecord} from './direct-run-certificate.mjs';
+import {directRunCertificateAllowed,directRunCertificate,directRunRecordable,directRunRecording,probeQuestions,validateRunRecord} from './direct-run-certificate.mjs';
+import {runFactChange} from './typescript-list.mjs';
 import path from 'node:path';
 import net from 'node:net';
 import os from 'node:os';
@@ -245,7 +246,10 @@ async function execute() {
       probeBefore=certificate?.value??(recording?null:probeHash(probePlan));
     }
     // The record arrives on fd 3, so the compiler's environment is unchanged.
-    const launched=certificate||recording?[command[0],'--require',path.join(here,'run-recorder.cjs'),
+    // Every direct run is recorded: even one checked by full probes needs its
+    // lookups outside the certificate, which no probe makes.
+    const recorded=directRunRecordable(selected)&&!unobservedDirectRun;
+    const launched=recorded?[command[0],'--require',path.join(here,'run-recorder.cjs'),
       ...command.slice(1)]:command;
     const record=[];
     // A Windows full reconciliation may finish while queued watcher callbacks
@@ -270,7 +274,7 @@ async function execute() {
       try{runLock.phase('launching');
         const launch=windowsLaunch(launched);
         child=spawn(launch.file,launch.args,{cwd:plan.cwd,
-        stdio:certificate||recording?['inherit','inherit','inherit','pipe']:'inherit',env:process.env,
+        stdio:recorded?['inherit','inherit','inherit','pipe']:'inherit',env:process.env,
         detached:process.platform==='linux',...launch.options});
         child.stdio[3]?.on('data',chunk=>record.push(chunk));}
       catch(e){resolve({status:'start_failed',exitCode:null,signal:null,errorCode:e.code||e.name});return;}
@@ -308,8 +312,10 @@ async function execute() {
     timing('cli.context_after',afterContextStarted);
     let probeAfter=null;
     const recordText=Buffer.concat(record).toString('utf8');
+    // Lookups the certificate does not cover, kept with the receipt.
+    let runFacts=[];
     if(certificate){
-      const issue=validateRunRecord(recordText,certificate);
+      const issue=validateRunRecord(recordText,certificate,runFacts);
       if(issue)captureIssues.push(`compiler inputs differ from discovery certificate (${issue})`);
       probeAfter=certificate.value;
     }else if(!unobservedDirectRun&&!recording)probeAfter=probeHash(probePlan);
@@ -319,7 +325,7 @@ async function execute() {
     const endSnapshotStarted=performance.now();
     if(!unobservedDirectRun){
       try{after=await call({action:'snapshot',name,contextHashes:contextHashes(),
-        ...(recording?{runCertificate:1,adopt:recording}:{})},captureTimeout);}
+        ...(recording?{runCertificate:1,adopt:recording}:recorded&&!certificate?{runCertificate:1,runFacts:1}:{})},captureTimeout);}
       catch{captureIssues.push('end observation unavailable');}
       finally{if(recordFile)fs.rmSync(recordFile,{force:true});}
       timing('cli.end_checkpoint',endSnapshotStarted,{available:after?.snapshots?.[name]?1:0});
@@ -327,16 +333,22 @@ async function execute() {
     const end=after?.snapshots?.[name];
     // The end certificate, recorded or probed, must cover what this compile received.
     // With no input event, gap or content change in between, it also holds at the start.
-    if(recording&&end?.recordingAccepted===true)probeBefore=probeAfter=end.probeHash;
-    else if(recording){
-      const endCertificate=directRunCertificate(plan,selected,end,root);
-      if(!endCertificate)captureIssues.push('no discovery certificate at the end checkpoint');
+    // A run checked by full probes is compared with it too, for its run facts.
+    if(recorded&&!certificate){
+      const endCertificate=directRunCertificate(plan,selected,end,root),
+        questions=endCertificate||(!recording&&probeQuestions(plan,selected,end,root));
+      if(!questions)captureIssues.push('no discovery certificate at the end checkpoint');
       else{
-        const issue=validateRunRecord(recordText,endCertificate);
+        const issue=validateRunRecord(recordText,questions,runFacts=[]);
         if(issue)captureIssues.push(`compiler inputs differ from discovery certificate (${issue})`);
-        probeBefore=probeAfter=endCertificate.value;
+        if(recording)probeBefore=probeAfter=endCertificate.value;
       }
     }
+    // The receipt holds only run facts that still answer as they did during the run.
+    runFacts.sort();
+    if(runFacts.length>10000)captureIssues.push('too many lookups outside the discovery certificate');
+    else{const changed=runFactChange(runFacts);
+      if(changed)captureIssues.push(`a lookup outside the discovery certificate changed during execution: ${changed}`);}
     if(recording&&snap?.observationGaps!==end?.observationGaps)
       captureIssues.push('observation gap during execution');
     if(!unobservedDirectRun&&(!end||!end.observationHealthy))captureIssues.push('end checkpoint unavailable');
@@ -355,7 +367,10 @@ async function execute() {
     if(!snap||!end||snap.planId!==end.planId||(recording?snap.inputKey!==end.inputKey:snap.fingerprint!==end.fingerprint)||
       snap.revision!==end.revision)captureIssues.push('declared inputs changed or were not observed');
     const stable=captureIssues.length===0;
-    const receipt={result,invocation,target,stable,fingerprintVersion:1,
+    // A recorded run's receipt carries its run facts, even none; observers that
+    // predate run facts do not reuse version 2.
+    const receipt={result,invocation,target,stable,fingerprintVersion:recorded?2:1,
+      ...(recorded?{runFacts}:{}),
       resolutionLinks:plan.resolutionLinks||[],
       coverage:{qualified:plan.unresolved.length===0,unresolved:plan.unresolved},
       checkpoint:{status:stable?'stable':'unavailable_or_changed',issues:captureIssues,

package/src/daemon.mjs

@@ -8,18 +8,19 @@ import {Worker} from 'node:worker_threads';
 import {fileURLToPath} from 'node:url';
 import {subscribe,hasHistory,backend} from './platform-observation.mjs';
 import {controlEndpoint} from './control-endpoint.mjs';
-import {observedRelative,withinPath,realObservedPath} from './path-identity.mjs';
+import {observedRelative,withinPath,realObservedPath,racyWindowMs} from './path-identity.mjs';
 import micromatch from './glob.mjs';
 import {sha} from './plan.mjs';
-import {InputIndex} from './index.mjs';
+import {InputIndex,dehydrateIndex} from './index.mjs';
 import {permittedRoots} from './installed-inputs.mjs';
 import {assertOwnedStatePlacement} from './owned-state.mjs';
 import {atomicJson,readReceipts,readReceiptSnapshot,receiptRevision} from './state-store.mjs';
 import {history,closeHistory} from './observation.mjs';
 import {inputKey,planGuard,toolchainKey} from './decision-validation.mjs';
-import {queriesHold} from './typescript-list.mjs';
-import {directProject,directProbeValue} from './direct-typescript.mjs';
-import {recordedCertificate} from './direct-run-certificate.mjs';
+import {queriesHold,runFactReason as runFactChanged} from './typescript-list.mjs';
+import {statusSummary} from './cached-state.mjs';
+import {directProject,directProbeValue,reviewedTypeScriptVersions} from './direct-typescript.mjs';
+import {buildInfoPath,recordedCertificate} from './direct-run-certificate.mjs';
 import {timing,mark,traceBase,traceContext,traceScope,traceEnvironment,traceId} from './decision-profile.mjs';
 
 const configFile=path.resolve(process.argv[2]);
@@ -223,7 +224,7 @@ function probe(row,allowReuse=false,{launch=true}={}) {
         /VSTATE_REASON:([a-z-]+)/.exec(out.stderr?.toString()||'')?.[1]:null;
       const explanations={
         'direct-typescript-implementation-unreviewed':'installed TypeScript bytes or membership differ from the reviewed compiler',
-        'direct-typescript-version-unsupported':'direct compiler recipe supports reviewed TypeScript 5.5.2, 5.6.3 and 5.9.3 only',
+        'direct-typescript-version-unsupported':`direct compiler recipe supports reviewed TypeScript ${reviewedTypeScriptVersions.join(', ')} only`,
         'direct-execution-environment-unsupported':'direct compiler rejects development helpers, Node cache/preloads, and unreviewed runtime overrides',
         'direct-node-version-unsupported':'direct compiler recipe supports Node 22 and 24',
         'npm-launcher-unobserved-inputs':'npm launcher uses unobserved notifier inputs; execution is recording-only',
@@ -232,7 +233,11 @@ function probe(row,allowReuse=false,{launch=true}={}) {
         'typescript-executable-changed':'local TypeScript executable changed or is missing',
         'typescript-config-unavailable':'TypeScript configuration cannot be resolved',
         'typescript-config-graph-unsupported':'TypeScript configuration extends, references, or uses compiler features outside this contract',
-        'typescript-incremental-unsupported':'TypeScript incremental or composite compilation needs explicit review',
+        'typescript-incremental-unsupported':'TypeScript composite compilation needs explicit review',
+        'typescript-buildinfo-outside-repository':'TypeScript incremental build-info file is outside the observed repository',
+        'typescript-incremental-unsound':'TypeScript assumeChangesOnlyAffectDirectDependencies makes an incremental result depend on build history',
+        'typescript-buildinfo-name-unsupported':'TypeScript build-info file needs a plain name ending in .tsbuildinfo',
+        'typescript-project-reference-consumed':'TypeScript program uses files of a referenced project, which plain tsc does not build',
         'typescript-config-outside-repository':'TypeScript configuration extends outside the observed repository',
         'typescript-plugin-unsupported':'TypeScript compiler plugin needs explicit review',
         'typescript-input-list-unavailable':'TypeScript input listing did not complete',
@@ -319,7 +324,8 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       plan_id:row.plan.id,observed_at:lastObservation,
       invocation:r?.invocation||null,target_provenance:r?.target||null,
       ...(r?.verificationRecipe?{verification_recipe:r.verificationRecipe}:{}),
-      coverage_at_run:r?.coverage||null,declared_inputs_match:null,reuse_eligible:false};
+      coverage_at_run:r?.coverage||null,declared_inputs_match:null,reuse_eligible:false,
+      ...(r?.runFacts?.length?{run_facts:r.runFacts.length}:{})};
     if(receiptStateError){item.reason=receiptStateError;return item;}
     if(!healthy||planning||recovering||index.unavailable){item.reason=
       (planning||recovering)?'input observation reconciliation pending':
@@ -330,7 +336,8 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
     if(pendingChecks.has(name)){item.reason='filesystem change pending content inspection';return item;}
     if(r&&r.planId) item.declared_inputs_match=r.planId===row.plan.id&&
       r.fingerprint===combinedSummary(name).fingerprint;
-    if(r&&r.fingerprintVersion!==1){item.reason='receipt uses earlier input-resolution format';return item;}
+    if(r&&!(r.fingerprintVersion===1||r.fingerprintVersion===2&&Array.isArray(r.runFacts))){
+      item.reason='receipt uses earlier input-resolution format';return item;}
     if(row.plan.unresolved.length){
       const checkpoint=item.declared_inputs_match===false?
         r.planId!==row.plan.id?'; observed input plan changed':
@@ -340,6 +347,9 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       return item;
     }
     if(row.probeError){item.reason=row.probeError;return item;}
+    // The plan leaves out the build-info file it saw at start; the probe sees the current one.
+    if(row.probeCache?.layout&&(row.probeCache.layout.buildInfo||null)!==(row.plan.buildInfo||null)){
+      item.reason='the incremental build-info setting changed after the observer started; restart the observer';return item;}
     // An expired probe or missing execution context cannot confirm CURRENT, but
     // observed input content that already differs from the receipt is STALE.
     let unconfirmed=!row.probeAt||Date.now()-row.probeAt>10000?'state probe observation expired':null;
@@ -396,11 +406,24 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       if(unconfirmed&&!(r.files&&row.staleInputs?.length)){item.freshness='UNVERIFIED';
         item.reason=unconfirmed;item.changed_inputs=[];}
     } else if(unconfirmed){item.freshness='UNVERIFIED';item.reason=unconfirmed;
+    // Lookups the run made outside the certificate are asked again for every
+    // answer, cached or synchronized, before it can say CURRENT.
+    // A direct run recorded before run facts may have made lookups no probe
+    // asks; only Windows, which never records direct runs, keeps reusing them.
+    } else if(r.fingerprintVersion===1&&r.verificationRecipe==='npm-direct-typescript@1'&&process.platform!=='win32'){
+      item.freshness='UNVERIFIED';item.reason='receipt predates run facts; run the check again';
+    } else if(r.runFacts&&(item.reason=runFactReason(r.runFacts))){item.changed_inputs=[];
     } else {item.freshness='CURRENT';item.reason=result==='FAIL'?'last command failed':'declared inputs match';
       item.reuse_eligible=result==='PASS';}
     return item;
   });
 }
+// Null when every run fact in a receipt answers as it did during the run.
+function runFactReason(facts) {
+  const started=performance.now(),reason=runFactChanged(facts);
+  timing('daemon.run_facts',started,{facts:facts.length,changed:reason?1:0});
+  return reason;
+}
 // The indexed inputs already differ from the latest receipt, so no probe result
 // can make this check CURRENT. A sync answers STALE without a full probe. A run
 // probes, or builds the certificate from its recording (adopt), and a revert
@@ -439,7 +462,7 @@ function adopt(name,row,token) {
     return done('inputs or certificate changed during the run');
   const cache=pending.cache,argv=row.plan.probes[0];
   let result;
-  try{result=recordedCertificate(text,cache,directProject(argv[2],argv[3],{verify:false}));}
+  try{result=recordedCertificate(text,cache,directProject(argv[2],argv[3],{verify:false}),buildInfoPath(row.plan));}
   catch{return done('recording unreadable');}
   if(result.issue)return done(result.issue);
   const identities=new Map(cache.identities);
@@ -454,14 +477,8 @@ function status(contextHashes,synchronizedInstalled=false,synchronizedFilesystem
   // Reload notifications accelerate visibility but are not required for it: a
   // wrapper may persist its outcome even when its control connection is denied.
   refreshReceipts();
-  const checks=rows(contextHashes,synchronizedInstalled,synchronizedFilesystem), current=checks.filter(r=>r.freshness==='CURRENT'&&r.result==='PASS').length,
-    failed=checks.filter(r=>r.freshness==='CURRENT'&&r.result==='FAIL').length,
-    observedFailed=checks.filter(r=>r.result==='FAIL').length,
-    stale=checks.filter(r=>r.freshness==='STALE').length,
-    unverified=checks.filter(r=>r.freshness==='UNVERIFIED').length||(!checks.length?1:0);
-  const stateName=failed?'failed':unverified?'unverified':stale?'stale':'current';
-  const now=Date.now();return {schema:1,receipt_revision:receiptStateRevision,state:stateName,current,failed,observed_failed:observedFailed,
-    stale,unverified,checks,
+  const checks=rows(contextHashes,synchronizedInstalled,synchronizedFilesystem);
+  const now=Date.now();return {schema:1,receipt_revision:receiptStateRevision,...statusSummary(checks),checks,
     observation:{healthy:healthy&&!planning&&!recovering&&!index?.unavailable,
       generation,observed_at:lastObservation,
       events:(index?.eventCount||0)+[...external.values()].reduce((n,e)=>n+(e.index?.eventCount||0),0),
@@ -496,16 +513,10 @@ function hydrate(bundle,saved) {
   }
   next.eventCount=saved.eventCount;next.rehashedFiles=saved.rehashedFiles;
   next.rehashedBytes=saved.rehashedBytes;next.profile=saved.profile;
+  next.racy=new Map(saved.racy||[]);
   return next;
 }
-function dehydrate(value) {
-  return {files:[...value.files],
-    aliasDependencies:[...value.aliasDependencies].map(([name,refs])=>[name,[...refs]]),
-    rows:[...value.checks].map(([name,row])=>({name,files:[...row.files],
-      sum:row.sum.toString('hex'),revision:row.revision,lastReason:row.lastReason})),
-    eventCount:value.eventCount,rehashedFiles:value.rehashedFiles,
-    rehashedBytes:value.rehashedBytes,profile:value.profile};
-}
+const dehydrate=dehydrateIndex;
 function retainIndex() {
   if(!index||!healthy||planning||pending.size||planDirty||historyDisabled||
     !fs.existsSync(snapshotPath))return;
@@ -958,7 +969,7 @@ async function request(message) {
     mark('server.decision_start',{decision,pending:pending.size,planDirty,planning,recovering,healthy,historyDisabled,decisionRequests,historyDeadlineMs,reconciliationDeadlineMs});
     timing('daemon.decision_reason',totalStarted,{decision,action:message.action,
       plan:process.platform==='win32'?'validate_dependencies_before_reuse':'existing_plan',
-      probe:'reuse_only_with_identical_content_and_context',installed:'current_content_required',
+      probe:'reuse_only_with_identical_content_and_context',installed:'current_identity_required',
       planPhase:metrics.planPhase||'initializing',pending:pending.size,
       notifications:metrics.notifications,planRebuilds:metrics.planRebuilds});
     if(process.platform==='win32'&&process.env.VSTATE_TEST_FAULTS==='1'&&
@@ -1065,6 +1076,20 @@ async function request(message) {
     }
     timing('daemon.request_probes',probeStarted,{checks:index?.checks.size||0});
     lastObservation=Date.now();publish();
+    // A run checkpoint never holds an installed identity from the racy window:
+    // a same-size write in the same timestamp tick would keep it. Wait the
+    // window out (at most 2 s), record those files again, and mark the
+    // checkpoint unusable if one is still inside it.
+    let racy=false;
+    if(message.action==='snapshot'||message.action==='prelaunch'){
+      const names=message.name?[message.name]:null;
+      const indexes=()=>[index,...[...external.values()].map(e=>e.index)].filter(Boolean);
+      const wait=Math.min(racyWindowMs,Math.max(0,...indexes().map(i=>i.racyUntil(names)))-Date.now());
+      if(wait>0){metrics.racyWaits=(metrics.racyWaits||0)+1;await new Promise(resolve=>setTimeout(resolve,wait+5));}
+      for(const i of indexes())i.settleRacy();
+      racy=indexes().some(i=>i.racyUntil(names)>Date.now());
+      if(racy)metrics.racyCheckpoints=(metrics.racyCheckpoints||0)+1;
+    }
     const applicabilityStarted=performance.now();
     const data=status(message.contextHashes,synchronizedInstalled,
       process.platform==='win32'&&healthy&&!planning&&!planDirty);
@@ -1075,18 +1100,16 @@ async function request(message) {
           planGeneration:row.plan.id,
             inputEventSerial:inputEventSerial.get(name)||0,
             probeHash:row.probeHash,inputKey:inputKey(row),observationGaps:metrics.gaps,
-            observationHealthy:healthy&&!planning&&!recovering&&applicableExternal(name).every(e=>e.healthy)};
+            observationHealthy:healthy&&!planning&&!recovering&&!racy&&applicableExternal(name).every(e=>e.healthy)};
       // Export only a currently guarded, check-specific discovery certificate.
       // The caller compares it with the answers its own compile received. Schema 2
       // certifies the realpath of every directory readDirectory visits. The
       // snapshot stays the start of the observed interval, including validation.
       if(message.runCertificate===1&&continuityBarrier()){
         const row=index?.checks.get(message.name),cache=row?.probeCache;
-        // The daemon checked the recording against the certificate it then validated.
-        if(recorded===null&&cache?.recorded===message.adopt&&cache.hash===row.probeHash&&
-          cache.input===inputKey(row)&&data.snapshots[message.name])
-          data.snapshots[message.name].recordingAccepted=true;
-        else if(row?.plan.qualification==='npm-typescript-direct-v1'&&
+        // Also after an accepted recording: the caller compares its record with
+        // this certificate and finds its run facts with it.
+        if(row?.plan.qualification==='npm-typescript-direct-v1'&&
           !row.plan.unresolved.length&&cache?.schema===1&&cache.input===inputKey(row)&&
           cache.hash===row.probeHash&&cache.guard===planGuard(index.bundle)&&
           cache.output&&cache.queryData&&data.snapshots[message.name])
@@ -1095,6 +1118,15 @@ async function request(message) {
             context:cache.context,output:cache.output,stderrHash:cache.stderrHash,
             queryData:cache.queryData};
       }
+      // For a run checked by full probes: the last probe's questions, only to
+      // find the run's lookups outside them. Never evidence for reuse.
+      if(message.runFacts===1&&data.snapshots[message.name]){
+        const row=index?.checks.get(message.name),cache=row?.probeCache;
+        if(row?.plan.qualification==='npm-typescript-direct-v1'&&cache?.queryData&&
+          typeof cache.context==='string'&&cache.input===inputKey(row)&&cache.hash===row.probeHash&&
+          cache.guard===planGuard(index.bundle))
+          data.snapshots[message.name].probeQuestions={context:cache.context,queryData:cache.queryData};
+      }
       const row=index?.checks.get(message.name);
       if(adopting.has(message.name)&&row?.adoption&&data.snapshots[message.name])
         data.snapshots[message.name].recordedCertificate=row.adoption.token;

package/src/declared-plan.mjs

@@ -5,6 +5,7 @@ import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {permittedRoots,resolveDeclaredInstalled} from './installed-inputs.mjs';
 import {qualifyTypeScript} from './typescript-qualification.mjs';
+import {directBuildInfo} from './direct-typescript.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
 import {observedRelative,withinPath,realObservedPath} from './path-identity.mjs';
@@ -16,6 +17,8 @@ const safePattern=value=>{
   const raw=value.startsWith('!')?value.slice(1):value;
   if(!raw||path.isAbsolute(raw)||raw.split(/[\\/]/).includes('..'))
     throw Error(`unsafe repository-relative input pattern: ${value}`);
+  // The observer never watches .git directories; excluding one is fine.
+  if(raw===value&&raw.split(/[\\/]/).includes('.git'))throw Error(`input pattern names a .git directory, which is not observed: ${value}`);
   return value;
 };
 
@@ -65,14 +68,22 @@ export function discoverDeclared(config) {
       catch(e){workspaceIssue=e.message;}
     }
     timing('plan.workspace_inputs',workspaceStarted,{available:workspace?1:0});
+    // An incremental direct check writes its build-info file during each run.
+    // It is compiler state, not an input, so the plan leaves it out. Read when
+    // the plan is built: a later change to it needs an observer restart, and
+    // until then the run reports the unexpected write and is not reusable.
+    let buildInfo=null;
+    if(selected.qualification==='npm-typescript-direct-v1')
+      try{buildInfo=directBuildInfo(root,selected.script);}catch{}
+    const excluded=buildInfo?['!'+buildInfo]:[];
     const installedStarted=performance.now();
     const installed=resolveDeclaredInstalled(root,
-      [...(selected.installedInputs||[]),...(workspace?.installed||[])],allowedRoots);
+      [...(selected.installedInputs||[]),...(workspace?.installed||[]),...excluded],allowedRoots);
     timing('plan.installed_resolution',installedStarted,{mappings:installed.mappings.length});
     const automatic=qualifyTypeScript(root,selected,
       {workspace,issue:workspaceIssue});
     const sourcePatterns=[...new Set([...selected.inputs,...(workspace?.source||[]),
-      ...(workspace?.generated||[])])].sort();
+      ...(workspace?.generated||[]),...excluded])].sort();
     const additivePatterns=[...new Set([...(selected.generatedInputs||[]),
       ...installed.internalPatterns])].sort();
     const unresolved=[...installed.unresolved,...(automatic?.issues||[]),
@@ -113,6 +124,7 @@ export function discoverDeclared(config) {
       installedMappings:installed.mappings,effectiveEnvironmentGlobs:{},
       probes:selected.probes||[],environment:selected.environment||{},
       qualification:selected.qualification||null,
+      ...(buildInfo?{buildInfo}:{}),
       executionProvenance:'declared-command',
       unresolved:[...new Set(unresolved)].sort()};
     plan.resolutionCandidates=workspace?.resolutionCandidates||[];